PQC Gate
A TCP front door that reads the TLS ClientHello and lets a connection through only when the client offered a post-quantum key-exchange group. A client that offered none is answered with a TLS handshake-failure alert and disconnected, so nothing behind the gate ever negotiates a classical-only key exchange.
The point is harvest-now-decrypt-later. A session whose key exchange is classical can be recorded today and opened once a quantum computer can solve the discrete log behind it, whatever the cipher protecting the bytes. Refusing at the front means a deployment can state that no session it served is in that recording.
It reads the ClientHello and nothing else: it does not terminate TLS, so it holds no key and sees no plaintext, and hands the bytes it read on to the real listener unchanged. The read is bounded in time and in size, so a client that opens a connection and says nothing, or says too much, is dropped rather than held.
Loopback bypasses by default, because a health check and a local probe should not have to speak post-quantum to reach the service.
b.pqcGate.clientHelloHasPQC(buf) #
Does this buffer hold a TLS ClientHello whose supported-groups extension names a post-quantum group? Answers a boolean, and answers false for anything it cannot read as a ClientHello, including a record that is truncated, one that is not a handshake record and one whose length fields point past the bytes present.
The groups it counts are b.constants.PQC_GROUPS.
var b = require("@blamejs/core");
b.pqcGate.clientHelloHasPQC(Buffer.alloc(0)); // → falseb.pqcGate.create(opts) #
{
internalPort: number, // the TLS listener's port; required, 1-65535
internalHost: string, // its host; default "127.0.0.1"
bypass: string[], // peers exempt from the check; default loopback
clientHelloTimeoutMs: number, // wait for the ClientHello; default 5000
maxClientHelloBytes: number, // ceiling on what is read; default 16384
log: object, // logger for refusals
}Build the gate as a node:net server. It is not listening yet: the caller calls listen on it, on the port the world reaches, and points internalPort at the TLS listener behind it.
A connection whose ClientHello names a post-quantum group is piped to the internal listener with the bytes already read written first, so the listener sees the whole handshake. One that names none is written a TLS handshake-failure alert and destroyed, which is what a TLS client expects rather than a bare close.
A peer address in bypass is piped through without the check, and the default list is the loopback addresses. A connection that sends nothing within clientHelloTimeoutMs, or more than maxClientHelloBytes before a complete ClientHello, is dropped.
var b = require("@blamejs/core");
var gate = b.pqcGate.create({ internalPort: 8443 });
gate.listen(443);